SUSPICIOUS — normal_5f872c387cb57.pdf
SUSPICIOUS — normal_5f872c387cb57.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 52 detection engines flagged it.
Identification
- SHA-256:
1203b258eeec2f18998ae427ab45942f6a5a310dc7d1804f687e01572aa9e04d - SHA-1:
68a760790fa0a7f2eb43a5f0e2931c86b5ee985a - MD5:
00ea4778fa1e317c159a41a95b96e3cc - ssdeep:
768:HgGzpD9eicEAgWNdrRS58Q6y4e2MQasJAQwWnDbnzkDSHLOSXQhZps6g6jC0M8mC:AGFxeiUvzkDSHqSXgZpU6jy8mb+zEMmo - TLSH:
T1EE328DF3509BCC4C7A879B136CB611A96189C78D6127DB9084CC7B6CC0BCAED7E61960 - Submitted as: normal_5f872c387cb57.pdf
- File type: pdf · Size: 46886 bytes
- Verdict: suspicious (44/100)
Detections (3 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/123?keyword=google+play+services+update+apk+file, https://cdn-cms.f-static.net/uploads/4366653/normal_5f87254f73a84.pdf, https://cdn-cms.f-static.net/uploads/4366312/normal_5f872463b85bb.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/123?keyword=google+play+services+update+apk+file
- https://cdn-cms.f-static.net/uploads/4366653/normal_5f87254f73a84.pdf
- https://cdn-cms.f-static.net/uploads/4366312/normal_5f872463b85bb.pdf
- https://cdn-cms.f-static.net/uploads/4366367/normal_5f87198e0521a.pdf
- https://cdn-cms.f-static.net/uploads/4366354/normal_5f8713364a927.pdf
- https://cdn.shopify.com/s/files/1/0491/7893/5448/files/56631521251.pdf
- https://cdn.shopify.com/s/files/1/0429/8699/5863/files/pisufovejunusebamopataro.pdf
- https://cdn-cms.f-static.net/uploads/4365608/normal_5f86f945ce663.pdf
- https://cdn-cms.f-static.net/uploads/4365586/normal_5f87190672354.pdf
- https://cdn-cms.f-static.net/uploads/4366035/normal_5f87186ea2220.pdf
- https://cdn-cms.f-static.net/uploads/4365624/normal_5f870a416db34.pdf
- https://cdn-cms.f-static.net/uploads/4365653/normal_5f8706e6c7cfb.pdf
- https://cdn.shopify.com/s/files/1/0481/2039/7987/files/18926919302.pdf
- https://cdn.shopify.com/s/files/1/0483/6071/8485/files/baltimore_county_retirement_lawsuit.pdf
- https://cdn.shopify.com/s/files/1/0430/4542/1205/files/chistes_de_pepito_rojos.pdf
- https://uploads.strikinglycdn.com/files/c4ab4e49-fd4a-4603-b8e0-d8d2561380bd/66338102797.pdf
- https://uploads.strikinglycdn.com/files/1dbd3af5-ac5f-4746-8e61-e835dc6af436/lanumowidinopok.pdf
- https://uploads.strikinglycdn.com/files/1c9ddf1a-7e51-4516-b09d-c378aacdd690/32410529976.pdf
- https://uploads.strikinglycdn.com/files/c2a674c2-3db9-417e-9e03-c2cb1a04b971/93663751655.pdf
- https://cdn-cms.f-static.net/uploads/4366035/normal_5f870e4785a38.pdf
- https://cdn-cms.f-static.net/uploads/4365541/normal_5f870dc4d581a.pdf
- https://cdn-cms.f-static.net/uploads/4365634/normal_5f8709a908435.pdf
- https://cdn-cms.f-static.net/uploads/4365525/normal_5f870d0343bcc.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- gettraff.ru
- cdn-cms.f-static.net
- cdn.shopify.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report